System and method for prediction of threatened points of interest

ABSTRACT

Embodiments that are described herein provide improved methods and systems for predicting threatened POIs. In some embodiments, an automated location tracking system tracks the locations of one or more target individuals. The locations of the target individuals may be tracked, for example, by tracking the cellular phones of the targets, or using various other automated location tracking techniques. Based on the tracked locations, a prediction system anticipates the future locations of the targets. Over time, the system uses this information to progressively narrow down the list of possibly-threatened POIs.

FIELD OF THE DISCLOSURE

The present disclosure relates generally to security systems, andparticularly to methods and systems for predicting locations of possiblethreats.

BACKGROUND OF THE DISCLOSURE

Security and law enforcement agencies invest considerable efforts andresources in anticipating and preventing illegitimate actions, such asterrorist attacks. In many cases, high-quality intelligence regarding anexpected attack is important in focusing available resources, and thusincreasing the chances of prevention and reducing unnecessary disruptionof normal activities.

SUMMARY OF THE DISCLOSURE

An embodiment that is described herein provides a method, which includesdefining one or more Points Of Interest (POIs) in a given geographicalarea. One or more target individuals, who are expected to carry out anillegitimate action at one or more of the POIs, are defined. Trackedlocations of the target individuals in the given geographical area arereceived from an automated location tracking system. A predicted subsetof the POIs, at which the target individuals are expected to carry outthe illegitimate action, is progressively narrowed down over time usinga computer, based on the tracked locations. The progressivelynarrowed-down predicted subset of the POIs is indicated to an operator.

In some embodiments, the illegitimate action includes a terroristattack. In an embodiment, receiving the tracked locations includesreceiving respective estimated locations of mobile communicationterminals operated by the target individuals.

In some embodiments, narrowing down the predicted subset includespredicting respective trajectories of the target individuals in thegiven geographical area, and narrowing down the predicted subset of thePOIs based on the predicted trajectories. In an embodiment, the one ormore target individuals include only a single target individual, andnarrowing down the predicted subset includes finding one or more of thePOIs that are in proximity to a predicted trajectory of the targetindividual.

In another embodiment, the one or more target individuals includemultiple target individuals, and narrowing down the predicted subsetincludes finding an intersection point of the predicted trajectories,and finding one or more of the POIs that are in proximity to theintersection point. In yet another embodiment, predicting thetrajectories includes determining the predicted trajectories based oncharacteristic location profiles of the target individuals.

In a disclosed embodiment, narrowing down the predicted subset includesidentifying a threatened region within the given geographical area, andfinding one or more of the POIs that are located inside the threatenedregion. In another embodiment, narrowing down the predicted subsetincludes receiving an indication that one or more of the POIs arementioned in monitored communication of the target individuals, anddefining the subset of the POIs based on the indication. In yet anotherembodiment, narrowing down the predicted subset includes receiving averification of an accuracy of the subset of the POIs, and modifying thesubset based on the verification.

There is additionally provided, in accordance with an embodiment that isdescribed herein, apparatus including a memory and a processor. The amemory is configured to hold a definition of one or more Points OfInterest (POIs) in a given geographical area, and a definition of one ormore target individuals who are expected to carry out an illegitimateaction at one or more of the POIs. The processor is configured toreceive tracked locations of the target individuals in the givengeographical area, to progressively narrow down, over time, based on thetracked locations, a predicted subset of the POIs at which the targetindividuals are expected to carry out the illegitimate action, and toindicate the progressively narrowed-down predicted subset of the POIs toan operator.

The present disclosure will be more fully understood from the followingdetailed description of the embodiments thereof, taken together with thedrawings in which:

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram that schematically illustrates a system forpredicting threatened Points of Interest (POIs), in accordance with anembodiment that is described herein;

FIG. 2 is a flow chart that schematically illustrates a method forpredicting threatened POIs, in accordance with an embodiment that isdescribed herein; and

FIGS. 3A-3C are schematic, pictorial illustrations showing examplegraphical output of a system for predicting threatened POIs, inaccordance with an embodiment that is described herein.

DETAILED DESCRIPTION OF EMBODIMENTS Overview

Terrorist attacks are often aimed at urban locations such as shoppingmalls, bus and train stations, stadiums, tourist sites and other publicplaces. Even when some intelligence is available regarding an imminentattack, in many practical cases it is difficult or impossible tosimultaneously protect a large number of possible threatened Points ofInterest (POIs). Moreover, protection often involves road closures,building evacuations, traffic diversions and other measures that disruptthe normal course of life and incur high economic cost. It is thereforehighly desirable to reduce the number of POIs that are to be protectedfrom the imminent attack.

Embodiments that are described herein provide improved methods andsystems for predicting threatened POIs. In some embodiments, anautomated location tracking system tracks the locations of one or moretarget individuals (referred to herein as “targets” for brevity) who areexpected to carry out an illegitimate action, such as a terroristattack. The locations of the target individuals may be tracked, forexample, by tracking the cellular phones of the targets, or usingvarious other automated location tracking techniques.

Based on the tracked locations, a prediction system anticipates thefuture locations of the targets. Over time, the system uses thisinformation to progressively narrow down the list of possibly-threatenedPOIs. In some embodiments, the target identities and locations areverified over time using various techniques, and the system uses theverification results to enhance the process of narrowing down the listof threatened POIs.

The prediction system indicates the current list of threatened POIs toan operator, for example by issuing a sequence of real-time graphicalalerts that gradually focus on a decreasing number of likely POIs. Thealerts may indicate the most likely POIs with respective confidencelevels, along with other relevant information regarding the POIs and/orthe attack. The prediction system typically provides the alerts during asufficient time frame prior to the attack (e.g., from 60-120 minutesbefore the attack), so as to enable effective prevention and/orresponse.

Based on this sort of progressive notification, authorities are able toassign available security resources to a relatively small of likelyPOIs, and thus increase the efficiency of use of these resources. Sincesecurity measures are applied to a small number of POIs, publicdisruptions such as road closures, evacuations and traffic diversionsare minimized. Moreover, even if the attack is not prevented, focusingon a small number of POIs increases the efficiency of subsequentresponsive actions.

System Description

FIG. 1 is a block diagram that schematically illustrates a system 20 forpredicting threatened Points of Interest (POIs), in accordance with anembodiment that is described herein. A system of this sort can be used,for example, by various security and law enforcement organizations forpredicting, preventing and responding to terrorist attacks. Inalternative embodiments, systems such as system 20 can also be used inother applications, such as crime prevention. The description thatfollows, however, focuses on anti-terrorist applications.

System 20 typically covers a certain geographical area, such as a city.The system attempts to identify Points of Interest (POIs) that arepossibly threatened by an imminent terrorist attack to be conducted byone or more predefined target individuals (“targets”). Typically, system20 receives tracked locations of the targets, which are obtained byestimating the locations of mobile communication terminals (e.g.,cellular phones) that the targets operate. Based on the trackedlocations, the system predicts the future trajectories of the targets,and attempts to identify the threatened POIs from the estimatedtrajectories.

In the present example, a target provisioning unit 24 specifies theidentities of the targets. In some cases, tracking a target individualrequires an issued judicial warrant. Thus, in some embodiments thesystem comprises an automated Lawful Interception (LI) warrant issuingmodule 40. In these embodiments, system 20 tracks only targets for whicha valid warrant has been issued. In alternative embodiments, where awarrant is not a requirement, module 40 can be omitted.

A location tracking system 44 tracks the locations of the provisionedtargets in the geographical area, e.g., by tracking the locations ofmobile communication terminals operated by the targets in a wirelessnetwork. Various techniques for tracking mobile terminals in wirelessnetworks are known in the art, and any suitable tracking technique canbe used for implementing system 44.

In one example embodiment, system 44 estimates the locations of thetargets by monitoring the communication of the targets' cellular phonesin the cellular network, and identifying the cells that currently servethe phones. The identity of the serving cell (often referred to asCELL_ID) is indicative of the phone location. In an embodiment, system44 improves the accuracy of CELL_ID-based location using suitablenumerical calculations.

An example technique for improved-accuracy location tracking isdescribed in U.S. patent application Ser. No. 12/840,233, which isassigned to the assignee of the present patent application and whosedisclosure is incorporated herein by reference. This technique improvesthe location accuracy based only on a database of base stationlocations, which can be obtained from the cellular service provider. Assuch, the technique is low-cost and simple to implement.

In some embodiments, system 20 comprises several units that enhance theinformation regarding the targets—in the present example an identitycorrelation unit 28, a target profiling unit 32 and a link analysis unit36.

Identity correlation unit 28 correlates multiple identifiers thatidentify the targets and/or their mobile communication terminals.Typically, a correlation between identifiers is established by detectingthat the identifiers are used in approximately the same location atapproximately the same time. The correlations are typically filtered,e.g., repeated at different locations and/or times, in order to removefalse correlations.

Identifiers that are suitable for correlation may be obtained from avariety of location/identifier sources, some of which may be external tosystem 20. Possible identifiers that can be correlated by unit 28 maycomprise, for example:

-   -   Car license plate numbers obtained from a License Plate        Recognition (LPR) system operated in the city.    -   Face images obtained by a face recognition system. Images of        this sort may be obtained, for example, by performing analytics        over Closed Circuit Television (CCTV) video surveillance of        individuals in public places or even inside vehicles. The        captured face images may be compared, for example, with a        database of face images of known terrorists.    -   Identifiers of mobile communication terminals, such as        International Mobile Subscriber Identity (IMSI), Mobile Station        International Subscriber Directory Number (MSISDN) or        International Mobile Equipment Identity (IMEI). Such identifiers        may be obtained, for example, from IMSI detection sensors        (sometimes referred to as “IMSI catchers”) deployed, for        example, at or near POIs. Mobile terminal identifiers may also        be obtained by target-centric real-time cellular location        tracking, e.g., obtained from cellular service providers.    -   Credit card identifiers, obtained, for example, from Points of        Sale (POS) and Automatic Teller Machines (ATM).    -   Internet Protocol (IP) addresses of mobile computing devices,        obtained, for example, from IP geo-location (e.g., laptop        location, Internet café access, or Wi-Fi access point location).    -   Fixed phone identifiers obtained from Public Switched Telephone        Network (PSTN) geo-location.    -   Target locations and associated identifiers received from        external Monitoring Centers (MC), Law Enforcement Agencies (LEA)        or security agencies.    -   Other identifiers obtained from communication monitoring, such        as names, identities or nicknames in social networks or other        applications, e-mail addresses, and many others.

For example, a CCTV system located at a certain POS may identify thelicense plate number of a car, obtain video footage that enables facerecognition of the passengers, at the same time obtain the IMSI of themobile phones operating in the car, and obtain the credit card numberused at the POS. All these identifiers may be correlated and associatedwith the same target or group of targets. Alternatively, any othersuitable technique can be used for obtaining and correlating identifiersthat are indicative of the targets.

Other example techniques for correlating identifiers, which can be usedby unit 28, are described, for example, in U.S. Pat. No. 7,882,217, andU.S. patent application Ser. Nos. 12/608,474, 13/187,438 and 13/253,935,which are all assigned to the assignee of the present patent applicationand whose disclosures are incorporated herein by reference.

In some embodiments, system 20 comprises a target profiling unit 32,which constructs characteristic location profiles for the targets. Thelocation profile of a given target may comprise, for example, thecharacteristic location of the target over time, for example over thehours of the day or over the days of the week or month. The profile mayindicate regular habits and behaviors of the target as they areexhibited by its location.

Typically, unit 32 constructs and continuously updates the locationprofiles of the targets based on the various location sources describedabove. Example techniques for location profiling, which can be used byunit 32, are described, for example, in U.S. patent application Ser.Nos. 12/628,089 and 13/283,532, which are all assigned to the assigneeof the present patent application and whose disclosures are incorporatedherein by reference.

In some embodiments, system 20 uses the location profiles produced byunit 32 in the process of identifying possible POIs that are threatenedby the targets. In some embodiments, the profiling process of unit 32may discover additional targets, e.g., additional members in a terroristgroup, by identifying additional individuals whose location profiles arecorrelative to those of known targets.

In some embodiments, link analysis unit 36 identifies relationshipsbetween different targets. Unit may identify the relationships, forexample, by identifying correlations between the target locationprofiles produced by unit 32. Additionally or alternatively, unit 36 mayreceive multiple financial records and telecommunication records fromany suitable sources (e.g., the location sources described above),including IP and cellular records such as Web browsing records, e-mails,social network records and many others). Unit 32 may use thisinformation to establish relationships between targets.

Using the link analysis process, unit 36 may identify additional targetsbased on their relationships with known targets, and/or verify newtargets identified by profiling unit 32. Example link analysistechniques that can be used by unit 36 are described, for example, inU.S. patent application Ser. Nos. 12/888,445, 12/964,891 and 13/244,462,which are all assigned to the assignee of the present patent applicationand whose disclosures are incorporated herein by reference.

Typically, unit 36 applies link analysis to the various possible targetidentities as they are continuously received from correlation unit 28,and to the various possible identifiers in the terrorist group as theyare being discovered by profiling unit 32.

System 20 comprises a mobile trajectory prediction unit 48, whichpredicts the future location trajectories of the targets' mobile devices(e.g., mobile phone or GPS receiver/modem) based on the availableinformation described above. The trajectory of a given target, relativeto its current location, is typically expressed in terms of directionand velocity. In an embodiment, unit 48 estimates the trajectory inreal-time, based on past location measurements of this target. Inpredicting the trajectory, unit 48 may also consider nearby POIs androad information. Unit 48 may also consider the location profileproduced for this target by unit 32.

System 20 comprises a threatened POI prediction unit 52, whichidentifies a subset of POIs that are most likely threatened by thetracked targets. Unit 52 receives the locations of the tracked targetsfrom unit 44, the predicted trajectories of the targets from unit 48,and the identified relationships between targets from unit 36.

In addition, prediction unit 52 receives information regarding the POIsfrom a POI model database 56. Database 56 comprises information such asPOI locations, outdoor and indoor modeling of POIs, opening hours,entrances, exits, parking areas, contact persons in case of emergency,semantic meaning, common names for the POIs, and/or any other suitableinformation. Database 56 may be stored in any suitable memory device.Accurate modeling is important for prediction accuracy of unit 52, aswell as for improving the response in case the attack ultimately occurs.

Based on the location and trajectory information of the targets and thePOI information, unit 52 attempts to predict which of the POIs are mostlikely to be attacked by the target at any point in time. As will beexplained and demonstrated below, the prediction of unit 52 is performedand updated in real-time, in order to progressively narrow down the listof likely POIs as the attack time approaches. The progressive POIprediction process may be performed, for example, from several hoursbefore the planned attack time, through the time the attack occurs or isprevented, and during the subsequent responsive action.

In some embodiments, prediction unit 52 receives inputs regarding thePOIs and/or targets from additional sources. In the present example,system 20 comprises a keyword spotting unit 64, which analyzes thecontent (e.g., intercepted speech of voice calls or intercepted text ofe-mails, text messages, chat or social network sessions) conveyed by thecommunication of the communication terminals of the tracked targets.Unit 64 applies keyword spotting or natural language analysis to thecontent, in an attempt to detect references to the POIs (e.g., POI namesor descriptions) in the analyzed content. Identifying a reference to agiven POI by a target will typically cause unit 52 to increase theconfidence that this POI is indeed threatened.

As another example, prediction unit 52 may receive input regarding thePOIs or targets from external intelligence sources 60, such as, forexample, positive identifications of targets by field agents, orinformation obtained from information sharing with other security orintelligence agencies.

Prediction unit 52 may apply various methods for predicting the subsetof threatened POIs. For example, in case of a single target actingalone, unit 52 may intersect the anticipated trajectory of the targetwith nearby POIs and with threatened POIs that were obtained fromexternal intelligence sources and/or keyword spotting.

In case of multiple targets acting together and arrive from differentlocations, unit 52 may find the intersection of the anticipatedtrajectories of the targets. Relative to the intersection point, unit 52may identify adjacent POIs and threatened POIs that were provided byexternal intelligence sources and/or keyword spotting. Additionally oralternatively, unit 52 may predict the threatened POIs using any othersuitable method.

As a by-product of this process, unit 52 may output an anticipated timeand place of a meeting between targets. Certain aspects of prediction offuture meetings are described, for example, in U.S. patent applicationSer. No. 12/708,558, which is assigned to the assignee of the presentpatent application and whose disclosure is incorporated herein byreference.

System 20 typically issues alerts that indicate the predicted subset ofthreatened POIs. Each alert typically indicates information such as theattack details, predicted time of the attack, the estimated location(one or more POIs and area), the type of the attack, the identities ofthe involved terrorists, the probability of occurrence of the attack,the confidence level of the assessment, and/or any other suitableinformation.

The alerts are provided to a monitoring center 68, in which avisualization unit 80 displays the alerts to an operator 72 on a display76. Typically, the alerts are displayed graphically on a map of therelevant geographical area. In some embodiments, the monitoring centercomprises a LI warrant issuing unit 84 (either in addition to or insteadof unit 40) that issues warrants for tracking targets to targetprovisioning unit 24.

In some embodiments, prediction unit 52 produces and outputs to themonitoring center a sequence of alerts, which progressively narrow downthe subset of likely threatened POIs. In a typical flow, the subset ofthreatened POIs is initially large since at that time (e.g., hoursbefore the time of attack) the intelligence is still general and theprediction of target trajectories is relatively inaccurate. Later intime, e.g., half an hour before the time of attack, system 20 has accessto higher-quality intelligence and location information, and istherefore able to improve the prediction accuracy and narrow down thesubset of POIs. Minutes before the attack, it may be possible to reducethe subset of threatened POIs to only a few POIs, or even a single POI.An example scenario of this sort is shown in FIGS. 3A-3C below. The timeframe before the attack during which alerts are provided may beconfigured by the operator.

In some embodiments, system 20 applies various verification measures forverifying the correctness and accuracy of the threatened POI prediction.In the present example, monitoring center 68 activates one or moreexternal verification sources 88, whose outputs are fed back toprediction unit 52. By modifying the POI prediction based on theverification results, system 20 is able to improve the predictionaccuracy and reduce the likelihood of false alarms.

One example form of verification is referred to as “crowd intelligence.”In such a scheme, the monitoring center invokes a call center totransmit a broadcast Short Messaging Service (SMS) or voice message tocellular phone users located in the vicinity of a certain POI. Themessage requests the recipients to report suspicious events they notice(e.g., person, vehicle or activity) using text and/or images. Inresponse to this broadcast message, the call center receives text and/orimages from cellular phone users, which report suspicious events. Themonitoring center may analyze the responses, for example using textanalysis, LPR or face recognition techniques, and feedback any relevantinformation regarding the targets or POIs to unit 52.

Unit 52 may modify the POI prediction based on the verification results.For example, if the responses show that a known target or vehicle isindeed spotted near a given POI, unit 52 may increase the confidencethat this POI is threatened.

Other possible forms of external verification may comprise, for example,miniature Unmanned Aerial Vehicles (UAV) that acquire video imageseither indoor or outdoor, video footage from police helicopters, videoimages from CCTV systems installed on streets or in public transportvehicles, or any other suitable sensor. The sensor input may be analyzedand fed back to unit 52, either manually, semi-manually orautomatically.

In some embodiments, unit 52 is also provided with statistical or otheranalysis of past terrorist attacks, and takes this information intoconsideration when predicting the threatened POIs.

The focused POI prediction provided by system 20 can be used byauthorities for coordinating various preventive measures. In particular,such preventive actions can be focused and concentrated around thesubset of threatened POIs, and thus reduce public disruption and wastingof resources. For example, authorities may send broadcast SMS messagesto mobile phones in the vicinity of the threatened POIs withinstructions for evacuation or other action. As another example, publictransport operators in the vicinity of the threatened POIs may beinstructed selectively. As yet another example, cellular communicationmay be jammed or monitored at or near the threatened POIs. Firstresponders (e.g., police or ambulance services) can be dispatched ontime and with greater accuracy.

The system configuration of system 20 shown in FIG. 1 is an exampleconfiguration, which is chosen purely for the sake of conceptualclarity. In alternative embodiments, any other suitable systemconfiguration can also be used. The elements of system 20 may beimplemented in hardware, in software, or using a combination of hardwareand software elements. In some embodiments, certain functions of system20 can be implemented using one or more general-purpose processors,which are programmed in software to carry out the functions describedherein. The software may be downloaded to the processors in electronicform, over a network, for example, or it may, alternatively oradditionally, be provided and/or stored on non-transitory tangiblemedia, such as magnetic, optical, or electronic memory.

Response to Attacks

In some cases, the prevention measures fail and the terrorist attacktakes place. In these scenarios, the focused POI prediction provided bysystem 20 helps to improve the quality and speed of responsive actionsthat are taken by authorities following the attack.

For example, when the authorities deploy a tactical Command and Control(C2) system for crisis management, which manages the post-attackresponsive actions, system 20 may be connected as one of the sensorsthat provide input to this C2 system.

Moreover, POI database 56 of system 20 can be made accessible to thetactical C2 system, and thus provide information that is valuable to theresponsive actions. For example, in some embodiments database 56comprises a hierarchal model of POI data in various levels, ranging fromthe national level (e.g., on a scale of 1:100000), city or localauthority level (e.g., on a scale of 1:10000), neighborhood level (e.g.,on a scale of 1:2500), complex or campus level (e.g., on a scale of1:500), building level (e.g., on a scale of 1:50), and room-indoor level(e.g., on a scale of 1:5).

At each level, POI data for the database is typically obtained fromdifferent sources. At the national level, for example, informationregarding historic monuments (such as location, opening hours, capacity,type, size, plan, entrance locations, manager identity and contactinformation) can be obtained from the municipality. Online informationfrom inside the monument, on the other hand, can be obtained fromsecurity cameras and crowd sourcing. This information can provideconsiderable value to responsive actions following a terrorist attack.

POI Prediction Method Description

FIG. 2 is a flow chart that schematically illustrates a method forpredicting threatened POIs, in accordance with an embodiment that isdescribed herein. The method begins by providing system 20 with a POIdatabase (e.g., database 56 of FIG. 1) in a certain geographical area,at a POI definition step 100. Target provisioning unit 24 predefines oneor more target individuals (“targets”) that are suspected of preparingfor a terrorist attack, at a target provisioning step 104.

Location tracking unit 44 tracks the locations of the targets, at alocation tracking step 108. Trajectory prediction unit 48 predicts thefuture trajectories (directions and velocities) relative to the currenttarget locations, at a trajectory prediction step 112.

Based on the POI database and on the locations and trajectories of thetargets, POI prediction unit 52 narrows down the list of POIs to apartial subset of the POIs that are most likely threatened by theattack, at a POI prediction step 116.

Unit 52 checks whether an alert condition is met, at a checking step120. For example, unit 52 may check whether the probability of attack isabove a certain threshold or if a certain time has elapsed since theprevious alert. If an alert is to be issued, unit 52 sends one or morealerts to monitoring center 68, at an alerting step 124. The alertsindicate the subset of threatened POIs as predicted by unit 52, alongwith other relevant information regarding the attack, the targets and/orthreatened POIs.

System 20 verifies the POI prediction using any of the above-describedverification sources or sensors, at a verification step 132. Innecessary, unit 52 modifies the POI prediction based on the verificationresults.

The method then loops back to step 108 above, and system 20 continues totrack the targets and progressively update the POI and narrow down thesubset of threatened POIs. If the attack was not prevented, appropriateresponsive actions are taken, at a response step 128.

Example Prediction Scenario

FIGS. 3A-3C are schematic, pictorial illustrations showing an examplesequence of graphical alerts that are displayed by system 20 to operator72 of monitoring center 68, in accordance with an embodiment that isdescribed herein. The figures demonstrate the process of progressivelyfocusing on a smaller area with a decreasing number of threatened POIsas the imminent attack approaches.

In this example scenario, FIG. 3A shows an alert issued at 8 PM, onehour before the planned attack time. The alert is displayed graphicallyon a map 140. A threatened region 144 is marked on the map. Two POIs (astadium and an art museum) inside region 144 are predicted asthreatened, and system 20 displays information windows 148 and 152regarding these POIs. The displayed information comprises relevantinformation regarding the threatened POI, the attack and/or the targets.

In some embodiments, system 20 uses a color scheme for grading theseverity of the alerts. For example, when the alert has low severity(e.g., a long time before the attack, or low confidence or probabilityof occurrence), the threatened POI and the corresponding informationwindow are colored blue. When the alert has medium severity, thethreatened POI and the corresponding information window are coloredorange. When the alert has high severity (e.g., immediately before theattack, or high confidence or probability of occurrence), the threatenedPOI and the corresponding information window are colored red.

In this example, at this stage, the two threatened POIs and informationwindows are still colored blue.

FIG. 3B shows an alert issued forty-five minutes later, at 8:45 PM,fifteen minutes before the planned attack time. At this stage, theseverity of the alert regarding the stadium has risen to high, and thestadium and its corresponding information window 148 are colored red. Anew alert, having low severity, is issued for the zoo that is alsoinside region 144. The zoo and its corresponding information window 152are now colored green.

FIG. 3C shows an alert issued ten minutes later, at 8:55 PM, only fiveminutes before the planned attack time. At this final stage, the size ofthreatened region 144 decreased, and only one threatened POI remains—Thestadium. The severity of the alert regarding the stadium is high, andthe stadium and its corresponding information window 148 are thereforecolored red. The alert regarding the zoo is removed.

Although the embodiments described herein mainly address prediction ofPOIs that are threatened by terrorist attacks, the principles of thepresent disclosure can also be used for predicting POIs that arethreatened by other illegitimate actions, such as crimes.

It will thus be appreciated that the embodiments described above arecited by way of example, and that the present disclosure is not limitedto what has been particularly shown and described hereinabove. Rather,the scope of the present disclosure includes both combinations andsub-combinations of the various features described hereinabove, as wellas variations and modifications thereof which would occur to personsskilled in the art upon reading the foregoing description and which arenot disclosed in the prior art. Documents incorporated by reference inthe present patent application are to be considered an integral part ofthe application except that to the extent any terms are defined in theseincorporated documents in a manner that conflicts with the definitionsmade explicitly or implicitly in the present specification, only thedefinitions in the present specification should be considered.

1. A method, comprising: defining one or more Points Of Interest (POIs) in a given geographical area; defining one or more target individuals at one or more of the POIs; receiving from an automated location tracking system tracked locations of the target individuals in the given geographical area; based on the tracked locations, progressively narrowing down, over time, using a computer, a predicted subset of the POIs at which the target individuals are expected to meet a predetermined criteria; and indicating the progressively narrowed-down predicted subset of the POIs to an operator.
 2. The method according to claim 1, wherein the predetermined criteria is an illegitimate action.
 3. The method according to claim 1, wherein receiving the tracked locations comprises receiving respective estimated locations of mobile communication terminals operated by the target individuals.
 4. The method according to claim 1, wherein narrowing down the predicted subset comprises predicting respective trajectories of the target individuals in the given geographical area, and narrowing down the predicted subset of the POIs based on the predicted trajectories.
 5. The method according to claim 4, wherein the one or more target individuals comprise only a single target individual, and wherein narrowing down the predicted subset comprises finding one or more of the POIs that are in proximity to a predicted trajectory of the target individual.
 6. The method according to claim 4, wherein the one or more target individuals comprise multiple target individuals, and wherein narrowing down the predicted subset comprises finding an intersection point of the predicted trajectories, and finding one or more of the POIs that are in proximity to the intersection point.
 7. The method according to claim 4, wherein predicting the trajectories comprises determining the predicted trajectories based on characteristic location profiles of the target individuals.
 8. The method according to claim 1, wherein narrowing down the predicted subset comprises identifying a threatened region within the given geographical area, and finding one or more of the POIs that are located inside the threatened region.
 9. The method according to claim 1, wherein narrowing down the predicted subset comprises receiving an indication that one or more of the POIs are mentioned in monitored communication of the target individuals, and defining the subset of the POIs based on the indication.
 10. The method according to claim 1, wherein narrowing down the predicted subset comprises receiving a verification of an accuracy of the subset of the POIs, and modifying the subset based on the verification.
 11. Apparatus, comprising: a memory, which is configured to hold a definition of one or more Points Of Interest (POIs) in a given geographical area, and a definition of one or more target individuals at one or more of the POIs; and a processor, which is configured to receive tracked locations of the target individuals in the given geographical area, to progressively narrow down, over time, based on the tracked locations, a predicted subset of the POIs at which the target individuals are expected to meet a predetermined criteria, and to indicate the progressively narrowed-down predicted subset of the POIs to an operator.
 12. The apparatus according to claim 11, wherein the predetermined criteria is an illegitimate action.
 13. The apparatus according to claim 11, wherein the processor is configured to receive the tracked locations by receiving respective estimated locations of mobile communication terminals operated by the target individuals.
 14. The apparatus according to claim 11, wherein the processor is configured to predict respective trajectories of the target individuals in the given geographical area, and to narrow down the predicted subset of the POIs based on the predicted trajectories.
 15. The apparatus according to claim 14, wherein the one or more target individuals comprise only a single target individual, and wherein the processor is configured to narrow down the predicted subset by finding one or more of the POIs that are in proximity to a predicted trajectory of the target individual.
 16. The apparatus according to claim 14, wherein the one or more target individuals comprise multiple target individuals, and wherein the processor is configured to narrow down the predicted subset by finding an intersection point of the predicted trajectories, and finding one or more of the POIs that are in proximity to the intersection point.
 17. The apparatus according to claim 14, wherein the processor is configured to determine the predicted trajectories based on characteristic location profiles of the target individuals.
 18. The apparatus according to claim 11, wherein the processor is configured to narrow down the predicted subset by identifying a threatened region within the given geographical area, and finding one or more of the POIs that are located inside the threatened region.
 19. The apparatus according to claim 11, wherein the processor is configured to receive an indication that one or more of the POIs are mentioned in monitored communication of the target individuals, and to define the subset of the POIs based on the indication.
 20. The apparatus according to claim 11, wherein the processor is configured to receive a verification of an accuracy of the subset of the POIs, and to modify the subset based on the verification. 